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Abstract - Structures and Mechanisms 

The Space Shuttle Orbiter has performed exceptionally well over its 30 years of flight 
experience. Among the many factors behind this success were robust, yet carefully 
monitored, structural and mechanical systems. From highlighting key aspects of the 
design to illustrating lessons learned from the operation of this complex system, this 
paper will attempt to educate the reader on why some subsystems operated flawlessly and 
why specific vulnerabilities were exposed in others. Specific areas to be covered will be 
the following: high level configuration overview, primary and secondary structure, 
mechanical systems ranging from landing gear to the docking system, and windows. 
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lb = pound 

STS-X = Space Transportation System, followed by the Space Shuttle mission number 
VAC = Volts Alternating Current 

Xo = Orbiter x-axis, fwd to aft direction 

Yo = Orbiter y-axis, port to starboard direction 

Zo = Orbiter z-axis, up and down direction (as Orbiter is on its wheels) 

I. Introduction 

T HE Space Shuttle Orbiter is a multi-use launch and return vehicle capable of carrying heavy payloads and 
astronauts into low earth orbit. The focus of this paper is to provide insight into the structural and mechanical 
configurations of the Orbiter and share noteworthy experiences from which key lessons learned were derived. This 
paper is organized first into an overview section, providing details on many of systems discussed later (in addition to 
those systems not discussed). Then, more specific challenges will be highlighted during both development and 
operations as significant processes or hardware configurations were affected. Finally, generic lessons learned will 
be presented as they emerged not from a single event, but rather repeated instances of lower level challenges that 
could have been designed out from the beginning. 


II. Orbiter Structures & Mechanisms System Overview 



Figure 2-1. Orbiter vehicle structural overview. 

The Orbiter structure is divided into ten major structural components: Forward Fuselage, Forward Reaction 
Control System (FRCS), Crew Module, Mid-Fuselage, Pay Foad Bay Doors (PFBD), Wings, Aft Fuselage, Vertical 
Tail, Body Flap, and Orbital Maneuvering System (OMS) Pods. The majority of the components are of conventional 
aluminum airframe construction, with the OMS Pods and Payload Bay Doors being the exceptions as they are made 
mostly of Graphite Epoxy material. The airframe is covered with reusable surface insulation of various types and 
thicknesses which protects the basic structure from the heat encountered during ascent and re-entry. These major 
structural elements utilize conventional assembly techniques and are joined together with rivets, bolts and welds. 
This section provides a brief overview of the major structural elements. Table 1 shows the contractors responsible 
for the manufacture of the various structural elements. 
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Table 1. Delineation of design/build responsibility for Orbiter structures. 


Major Structural Element 

Contractor Responsible 

Forward Fuselage 

Rockwell’s Space Transportation Systems Division, Downey, California 

FRCS 

Rockwell’s Space Transportation Systems Division, Downey, California 

Crew Module 

Rockwell’s Space Transportation Systems Division, Downey, California 

Mid Fuselage 

General Dynamics Corp., Convair Aerospace Division, San Diego, California 

Pay Foad Bay Doors 

Rockwell’s Tulsa Division, Tulsa, Oklahoma 

Wing and Elevons 

Grumman Corp., Bethpage, New York 

Aft Fuselage 

Rockwell’s Space Transportation Systems Division, Downey, California 

OMS Pods 

McDonnell Douglas, St. Fouis, Missouri 

Vertical Tail 

Fairchild Republic, Farmingdale, New York 

Body Flap 

Rockwell’s Columbus Aircraft Division, Columbus, Ohio 
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Figure 2-2. Orbiter Vehicle Mechanism Overview. 

The Orbiter’ s mechanisms control the moving mechanical assemblies on the Orbiter, ranging from the docking 
systems to landing gear. These mechanisms are comprised of electromechanical actuators, manually driven 
actuators, pyrotechnically actuated devices and hydraulically driven actuators, along with their associated linkages 
and gearboxes. Each of those systems is detailed in sections below, beginning with Section J. 

A. Forward Fuselage and Forward Reaction Control System 

The forward fuselage is that portion of the shuttle which extends from the nose cap aft to the interface with the 
mid fuselage. It consists of the upper forward fuselage and lower forward fuselage sections. The upper section 
includes the six forward outer window panes (thermal panes), and the two outer panes of the overhead windows. 
The lower section includes the attach provisions for the nose cap, the nose landing gear wheel well and landing gear 
doors, the forward external tank (ET) attach point, the crew hatch, and the attach points for the forward reaction 
control system. The aft most frame of the forward fuselage, together with the aft bulkhead of the crew module, 
forms the forward wall of the payload bay. 
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Separation of the forward fuselage into the upper and lower sections allows for the installation of the pressurized 
crew module as a single unit. The crew module fits entirely inside the forward fuselage and is attached at four 
primary points. 


• ALUMINUM CONSTRUCTION 

• RIVETED SKIN/STRINGER/FRAME STRUCTURE 



Figure 2-3. Forward Fuselage. 

Also provided on the forward fuselage are attachment provisions for installing antennas and deployable air data 
probes. Two doors located on the left side between the forward windows and forward reaction control system open 
to provide unobstructed viewing by the two crew module mounted star trackers. 

The forward fuselage is constructed entirely of conventional aluminum alloy skin-stringer panels, frames and 
bulkheads. The upper forward bulkhead consists of flat aluminum and formed sections riveted and bolted together; 
the lower bulkhead is a machined piece. The structure for the nose landing gear wheel well is made up of support 
beams, closeout webs, drag-link support struts, nose landing gear strut and actuator attach fittings, and the nose 
landing gear door fittings. The nose landing gear doors are constructed of aluminum alloy honeycomb. When closed, 
the landing gear doors are sealed with both a pressure seal and a thermal barrier. The forward external tank attach 
fitting is secured to the lower forward fuselage bulkhead and the skin panel structure immediately aft of the nose 
gear wheel well. The nose cap is constructed of reinforced carbon-carbon (RCC) with pressure seals and thermal 
barriers at the nose-cap to structure interface. 

The two halves of the forward fuselage surround the pressurized crew module and provide thermal and body- 
load isolation. In addition to the fuselage bending loads, the forward fuselage reacts the crew module inertial loads, 
nose landing gear loads, external tank attach fitting loads, and the forward reaction control system loads. 

The window cavity conditioning system conditions the airspace surrounding the forward windows, overhead 
windows, crew hatch window, and star tracker openings. Flexible boots between the forward fuselage and crew 
compartment provide air volume isolation. 

The FRCS module is constructed of conventional aluminum alloy skin-stringer panels and frames. The FRCS 
module is secured to the lower forward fuselage nose section and forward bulkhead of the upper forward fuselage 
with 1 6 fasteners, which permit the installation and removal of the module along with all of the associated thrusters, 
fuel tanks, and plumbing as a single line-replaceable unit. The FRCS module reacts all of the thruster and fuel tank 
loads and transmits them to the forward fuselage structure. 
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H* PRIMARY THRUSTERS 



Figure 2-4. Forward Reaction Control System Module. 


A flexible membrane between the aft bulkhead of the forward fuselage and the crew compartment aft bulkhead 
seals off the forward fuselage from the payload bay. Thermal barriers and environmental seals are installed around 
the periphery of the FRCS and the thruster interfaces to prevent intrusion of hot gases as well as to act as a purge 
barrier and moisture seal. Purge and vent control for the volume between the forward fuselage structure and the crew 
module, the forward reaction control system, nose landing gear volume, and nose cap volume is provided by 
controllable vent doors on both sides of the forward fuselage sidewall skins. 

B. Crew Module 

The crew module is the structure that maintains the crew “shirt sleeve” environment and provides the provisions 
necessary to ensure the human presence in space. It consists of integrally machined skin-stringer aluminum panels 
welded together to form a pressurized compartment, and it is installed within the outer protective shell of the 
forward fuselage. The crew module attaches to the forward fuselage via four structural links, which minimize the 
load and heat transfer between the forward fuselage and crew module structures. The maximum certified flight 
weight with all stowage, crew and cargo is 30,000 lbs. The total volume is 2625 cubic feet. 

The crew module has three internal levels. The top level, called the flight deck, is where the commander and 
pilot and two other astronauts are seated for ascent and entry. This is the deck where the windshield windows are 
attached, as well as the overhead and payload bay viewing windows. There are two inter-deck access openings from 
the flight deck to the next lower deck, the middeck. 

The middeck can seat up to three crewmembers for ascent and entry and can accomodate thousands of pounds of 
stowage. There are provisions for a variety of stowage areas including large fabric bags and lockers. Additionally, 
the Waste Collection System (WCS, or toilet) and galley reside in the middeck. To meet the various mission 
objectives, the middeck can be configured with a sleep station compartments or simple sleeping bags for the crew. 
Crew exercise equipment is also stored in the middeck. 

The bottom level of the crew module, under the mid-deck, is the equipment bay. This area is the location for a 
variety of avionics equipment, life support equipment, data acquisition equipment, and stowage. 

C. Windows 

The Orbiter window subsystem consists of six forward facing windshield windows, two rectangular overhead 
(canopy) windows, two payload bay viewing windows, one ingress/egress hatch window, three airlock hatch 
windows, and two External Tank camera windows. Each window in the windshield, canopy and ingress/egress hatch 
consists of three panes. The payload bay viewing windows have two panes, and the airlock hatches have one pane. 

The general design of the windshield windows consists of three panes. The outer pane, called the thermal pane, 
is made from fused silica glass and provides thermal protection for the vehicle during entry. The center pane, called 
the redundant pane, is also made from fused silica and was intended to be redundant to the thermal and pressure 
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panes. The innermost pane, the pressure pane, is made from thermally tempered aluminosilicate glass. Each of these 
panes is made of a different thickness, specifically designed for the loads it was expected to withstand. 

The only difference between the windshield windows and the overhead windows is that the overhead redundant 
pane is not fused silica, but thermally tempered aluminosilicate glass, the same as the pressure pane. The payload 
bay (aft) viewing windows each consist of two thermally tempered aluminosilcate panes, and the ingress/egress 
window uses a three pane design, all of fused silica glass. 

The window subsystem also includes single acrylic panes installed on three airlock hatches. The first of these 
hatches are on the crew module aft bulkhead, and two are on the external airlock. Finally, there are two windows 
installed on the belly cavity of the Orbiter in the external tank umbilical area. These windows provide ascent 
protection for two still cameras that are used for imaging the external tank after separation. 

D. Mid-Fuselage and Payload Bay Doors 

Between the forward and the aft fuselage sections is the mid-fuselage. The ends of the mid-fuselage are open, 
and interface with the bulkheads and skins of the forward and aft fuselages. The forward lower portion of the mid- 
fuselage includes the wing glove fairings, and the wings attach to the mid-fuselage side walls on the lower aft 
portion. The inboard supports for the main landing gear are on the sidewall of the mid-fuselage in the wing shadow 
area. Together with the payload bay doors, aft bulkheads of the forward fuselage and crew module, and forward 
bulkhead of the aft fuselage, the assembly forms the payload bay of the Orbiter. 

The mid- fuselage is a somewhat squared off U-shaped cross section. The uppermost structure consists of the sill 
longeron and at the bottom corners of the "U" are the lower longerons. Twelve main-frame assemblies stabilize the 
mid- fuselage structure and divide the mid-fuselage into thirteen bays. The main frames consist of machined 
members on the vertical sides above the wing and glove-fairing areas, and aluminum/boron truss construction in the 
lower area spanning across the bottom of the Orbiter. Thirteen machined aluminum stub-frames stabilize the 
sidewalls between the main frames. The two aft-most bays have structural panels aligned with the wing upper 
surface and form part of the wing carry through structure. 

The mid-fuselage skins are either machined aluminum panels or aluminum honeycomb sandwich. The sidewall 
panels in the first eight bays above the wings and glove fairings are stiffened with integrally machined longitudinal 
T-stringers while aft most five bay sidewalls are of aluminum honeycomb. Machined aluminum ribs and chemically 
milled aluminum skins form the wing glove fairings. The side wall panels in the wing shadow areas are machined 
panels with vertical stiffeners. Bottom surface skin panels in the first 11 bays are machined with longitudinal T- 
stringers. Bays twelve and thirteen form the wing carry through structure and have machined aluminum waffle 
pattern skins on the lower surface, and panels with laterally machined T-stiffeners forming the upper surface. 
Payload bay liners close off the payload bay area from the lower mid fuselage. The liners are not primary load 
carrying members and do not add to the structural strength of the Orbiter. 



Figure 2-5. Mid-Fuselage. 
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The payload bay doors are attached via hinges to the sill longeron. The shuttle remote manipulator system and 
Ku band antenna are also attached to the sill longeron. Payloads are attached to the sill longeron and centerline of 
the payload bay. Various tanks and avionics shelves are housed in the bays between the main frames under the 
payload bay liner. 

There are two payload bay doors, left and right, which complete the upper portion mid-fuselage area and form 
the closure over the payload bay. Each door is made up of five segments. Each segment is connected to the adjacent 
segment with shear pins which allows for thermal expansion in the forward and aft direction. The doors are attached 
to the sill longeron with external hinges which are designed to accommodate thermal expansion fore and aft. Thirty- 
two latches hold the payload bay doors in position when closed - sixteen centerline latches, eight floating forward 
bulkhead latches, and eight fixed aft bulkhead latches. 

One of two exceptions to the conventional aluminum airframe construction used on most of the Orbiter, the 
payload bay doors are made up honeycomb sandwich skin panels consisting of graphite -epoxy face sheets and a 
Nomex core. The skin panels are attached to graphite-epoxy frames which provide additional stiffness. 

Primary body-bending loads are carried by the sill and lower longerons together with the side and lower skin 
panels. Ascent thrust loading is carried by the sill and lower longerons which transfer this load to the forward 
fuselage and mid-fuselage skins. The payload bay doors do not carry body-bending loads or thrust loads (fore/aft 
loads). However, when closed and latched, the payload bay doors act together with the mid-fuselage to form a 
closed torque box to carry body torsional loads. 

The payload bay doors are sealed around the periphery with pressure seals and thermal barriers. While the 
payload bay is not is not a pressurized area, the seals allow for a relatively airtight environmental enclosure for the 
payload-bay/mid- fuselage volume. Purging and venting of the volume are accommodated with vent doors installed 
on the side walls of the mid-fuselage. 

E. Wings and Elevons 

The wing configuration on the Orbiter is a double-delta wing design, and it functions as an aerodynamic lifting 
surface that provides lift and flight control for the Orbiter during atmospheric flight. The wing is of conventional 
aluminum aircraft construction of ribs, spars and skin panels. The wings consist of the wing glove; the intermediate 
section, which includes the main landing gear well; the torque box; the forward spar for mounting the RCC leading 
edge thermal protection system; the wing/elevon interface; the elevon seal panels; and the elevons. 

The wing glove is composed of upper and lower skins stiffened with stringers running forward and aft. Holding 
the skins in place are seven ribs stabilized by aluminum truss tubes along with a corrugated aluminum spar and an 
aluminum honeycomb leading edge. 



Figure 2-6. Wings and Elevons. 

The intermediate wing section consists of the conventional aluminum ribs and aluminum truss tubes. The upper 
and lower skin covers are constructed of aluminum honeycomb. The intermediate section houses the main landing 
gear compartment and reacts the outboard portion of the main landing gear loads. Support for the inboard main 
landing gear is provided by the mid-fuselage. The main landing gear door is fabricated from aluminum honeycomb 


7 

American Institute of Aeronautics and Astronautics 



and is sealed with pressure and thermal barriers. The primary load carrying structure of the wing is the torque box 
section. It interfaces with the mid-fuselage and aft fuselage wing carry through structures. It consists of four spars 
and twelve ribs covered with aluminum skins stiffened with stringers and closed off on the outboard side by the 
wing leading edge spar. 

The elevons are also of conventional rib and spar construction with aluminum honeycomb skins. Made up of two 
sections, inboard and outboard, the elevons are attached to the rear spar of the torque box via hinges and actuators 
with seal provisions to prevent intrusion of heated air. 

RCC panels are attached to the leading edge spar and make up the leading edge of the wing. Purge and vent 
control of the wing and main landing gear volumes are provided by outflow valves on the torque box rear spar. 
Venting of the elevons is provided by vent holes in the lower surfaces of the elevon structure. 


F. Aft Fuselage 

The aft fuselage is consists of an outer shell, an internal truss-type thrust structure, and secondary structure for 
systems attachment. It interfaces with the structure of the mid fuselage, payload bay doors, wings, vertical tail, body 
flap, and Orbiter maneuvering system pods. The ET aft attachments are located on the bottom of the aft fuselage. 

The outer shell is composed of integrally stiffened, machined aluminum skins attached to frames. The forward 
bulkhead functions as the aft wall of the payload bay, forms part of the wing carry through structure, and provides 
the forward attach point for the vertical tail. The vertical side walls provide attachment for the aft portion of the 
wing at the Xo=1365 bulkhead, an interface for the T-0 umbilical (connection that releases as the launch countdown 
clock reaches zero), and include a door on each side for access to the compartment. The upper portions of the aft 
fuselage are inclined toward the centerline and provide a mounting surface for the OMS Pods. A horizontal upper 
deck provides for the aft attachment of the vertical tail. The floor of the aft fuselage provides attach points for the 
external tank structure along with the associated fuel lines and electrical interface on the forward end, and the 
attachment of the body flap on the aft end. Two machined doors close over the ET attach points after the ET has 
been jettisoned. The base heat shield forms the rear most wall of the aft fuselage. The base heat shield interfaces 
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Figure 2-7. Aft Fuselage. 

with, and contains sealing provisions for, the metallic honeycomb engine mounted heat shields. 

The thrust structure is fabricated from diffusion-bonded titanium on Space Shuttle Discovery and Atlantis, and 
of forged titanium supports on Endeavor. The thrust structure supports the three shuttle main engines and provides 
the primary load path for the engine thrust loads to the ET attach points and the sill and lower longerons of the mid- 
fuselage. 
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Pressure seals and thermal barriers are provided around the ET doors, vertical tail, and engine heat shields. Purge 
and vent control is provided by active vent doors mounted on the vertical side walls of the aft fuselage. 

G. Orbital Maneuvering System Pods 

There are two OMS Pods attached to the upper aft fuselage structure. The pods are mirror images of one another 
and there is one pod mounted on each side of the vertical tail. The main portion of the pod contains the fuel, oxidizer 
and fuel-pressurization tanks for both the orbital maneuvering system engine and the aft reaction control system 
(RCS) engines. A RCS Housing, or ’’stinger”, is attached to the outboard aft end of the pods which houses the 
reaction control system engines. The pods are self contained, modular units, designed for easy change-out and are 
attached to the aft fuselage with eleven bolts. The OMS structure supports the OMS and RCS fuel system tanks and 
reacts the OMS and RCS engine loads and transfers them to the aft fuselage. 



System View 


Structural Layout 


Figure 2-8. OMS Pods. 

The OMS Pod skins are made from composite honeycomb sandwich panels consisting of graphite -epoxy face- 
sheets and Nomex core. Intermediate internal frames are fabricated from graphite-epoxy laminate. Most of the 
remainder of the OMS and RCS Housing structure is of conventional aluminum construction including the forward 
and aft bulkheads, the tank support bulkheads, the OMS thrust structure, cross braces, and floor truss beams. The 
centerline web is aluminum sheet with titanium and graphite-epoxy stiffeners. Forward and aft attach point fittings 
are machined aluminum while the intermediate fittings are machined corrosion resistant steel. 

A pressure seal and thermal barrier surround the periphery of the pod at the interface with the aft fuselage. Purge 
and vent control are accomplished through the aft fuselage. 

H. Body Flap 



Figure 2-9. Body Flap. 
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The body flap is attached to the lower aft edge of the aft fuselage. It provides protection for the shuttle main 
engine bells and helps provides pitch control for the Orbiter during atmospheric flight. 

The forward portion of the body flap consists of an aluminum leading edge main spar, four machined aluminum 
actuator ribs, eight aluminum honeycomb stability ribs, two aluminum honeycomb end closeout ribs, and aluminum 
honeycomb upper and lower skin panels. The aft portion consists of a full depth aluminum honeycomb trailing edge 
with the forward closeout skin and piano hinge angle caps forming the rear spar. The forward portion is attached to 
the aft portion with piano hinges on the upper and lower surface. An articulated pressure and thermal barrier is 
provided to protect the main spar from excessive heating. Venting and drainage is provided via drain lines which 
penetrate the trailing edge honeycomb. 


I. Vertical Tail 



The Orbiter vertical tail primarily consists of the leading edge, rudder/speed-brake (RSB), and a lower tailing 
edge that houses a drag chute and the power drive unit (PDU) used to actuate the RSB. The rudder is split into two 
halves to serve as a speed brake. There is a 40 ft. diameter drag chute that deploys at touch-down to reduce landing 
distance and minimize tire wear. The vertical tail structure is made of integrally machined aluminum skins and 
stringers, with the main torque box (structural fin) made from ribs and two machined spars (leading edge and trailing 
edge spars). The assembly is attached by two tension bolts at the front spar of the vertical tail to the forward 
bulkhead of the aft fuselage, and by eight aft lugs at the root of the vertical tail rear spar to the upper surface of the 
aft fuselage. 

The RSB control surface is made of conventional aluminum ribs and spars with aluminum honeycomb skin 
panels. The RSB panels are attached via links and fittings to rotary actuators. The thermal conical seal consists of 
curved metallic honeycomb seal panels and machined seal sectors. The seal sectors are supported by the rudder 
hinge fittings and restrained by a unique arrangement of links and struts to minimize distortion and deviation of the 
surface from its basic contour when subjected to thermal and pressure forces. 

A thermal barrier and environmental seal is also employed at the interface of the vertical stabilizer and aft 
fuselage. Purge and vent control is provided through the aft fuselage. 

J. Electromechanical Systems 

The majority of Orbiter Mechanisms are electromechanical, using two high speed 120 VAC 400 Hz motors, a 
torque limiter and planetary gearset(s). The torque output varied by application. 

The PLBDs use three mechanical systems: a door drive, centerline latch and bulkhead latch. The door drive 
system uses one electro-mechanical PDU per side. The PLBD drive output of this somewhat centrally located 
actuator is sent to six individual rotary actuators. The each gear box output drove a linkage connected to the door, 
opening or closing the door. The doors are latched along both the forward and aft bulkheads (four bulkhead sets) as 
well as the long centerline edge of the door (four centerline sets). At both the forward and aft bulkheads, each door 
latched by four individual bulkhead latch hooks is ganged together by linkages to the PDU. The centerline latch 
gangs also consisted of four hooks per gang, but is connected by a drive shaft and then linkages. 
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The PLBD’s also contain two deployable radiator panels on the forward half of each door. Each set of panels 
use both a drive system and latch system. The drive system is similar to the PLBD drive system in that it uses one 
PDU connected to four rotary actuators, two per panel. The latch system uses one PDU per panel connected to three 
rotary actuators with latch hooks. 

Manipulator Positioning Mechanisms (MPMs) in combination with Manipulator Retention Latches (MRLs) were 
first used on the Orbiter to latch / release and deploy / stow the Remote Manipulator System (RMS) and later the 
Orbiter Boom Sensor System (OBSS). The MPMs are deployed after the PLBDs are opened, positioning the RMS / 
OBSS away from the PLBD to allow for payload deployment. The MRLs are nested in the “valley” of the MPM 
and have two latch hooks that capture a striker bar on the RMS / OBSS. The RMS MPM’s one shoulder MPM (the 
RMS bolts to the top of the MPM) and three MPMs with upper pedestals containing MRLs. The OBSS uses three 
MPMs with the same upper pedestals, but the forward MPM has a modified upper pedestal to react loads in the Xo 
direction. The MPMs on each side are driven by one PDU that is connected by drive shafts to a rotary actuator in 
the base of each MPM. The PDU, linkages and latch hooks are all one, compact, unit for the MRL to allow it to be 
housed inside of the MPM. 

Removable payloads are held inside of the payload bay by Payload Retention Latch Actuators (PRLAs) and 
Active Keel Actuators (AKAs). These actuators are atypical in that they do not have torque limiters. Lor large 
payloads, four PRLAs are mounted on the Orbiter sill. The forward PRLAs are allowed to float in Xo, with the 
trunnions free to float in Yo and fixed in Zo. The aft PRLAs are restrained in Xo and Zo. The AKA is located in 
the bottom of the Payload Bay and restrains the payload in the Yo direction. The PRLAs have a clamshell latch 
while the AKAs opened and closed opposing halves along the Xo direction. 

The Ku-Band Antenna Actuator rotates the antenna boom into the Payload Bay for PLBD closure and out for 
antenna use. The electric motors and gear train are enclosed in the base of the antenna mounted to the Orbiter sill, 
just behind the crew cabin. 

The fuel lines from the External Tank (ET) are connected to the bottom of the Orbiter. The External Tank Doors 
(ETDs) are closed on orbit to protect the ET umbilical area from hot gas during reentry. During ascent, the ETDs 
are held open by two centerline (CL) latches. This latch has a “T” shaped latch bar, with each end of the “T” 
latching into a slot on the edge of each door. One CL latch captures the forward portion of the door with the other 
latch capturing the aft portion. During ETD closure procedures, the latch is rotated out of the door fitting and pulled 
in flush with the bottom of the Orbiter. The ETD Drive Actuator, through a system of linkages, closes the door, 
until a “Ready- to-Latch” indication is obtained via limit switches. The ETD Uplock Actuator then drives three latch 
hooks, through a system of linkages, capturing latch rollers on the ETD. The actuator then pulls the door in to a 
final position, sealing the umbilical cavity. 

Pressure within the fuselage is controlled by the opening and closing of a series of vent doors, seven on each 
side. These doors are open on ascent to vent the fuselage to vacuum, closed prior to reentry to prevent hot gas 
ingestion and opened after the heating regime has passed to allow equalization to atmospheric pressure. The doors 
are operated by a PDU and linkage system. Doors 1 &2 and 8 & 9 are operated in pairs, with each pair having their 
own PDU. These doors have three positions: open, closed and purge (a partially open position). Doors 3, 5 and 6 
each have their own PDU and have open and closed positions. 

At approximately mach 5 on decent, an Air Data Probe (ADP) is deployed on each side of the Orbiter nose. 
Each ADP is deployed by rotating it approximately 180 degrees by a PDU driven gear train. When stowed, the 
outside of the ADP is protected by thermal tiles and seals to prevent hot gas ingestion. 

On orbit, two star trackers are used for navigation, one facing the Y direction and the other facing the Z 
direction. A door for each star tracker is closed for ascent and entry and opened on orbit. The edge of the door has 
rollers that rest in a track. The door is rotated in the track by a PDU and gear train. 

K. Orbiter Docking System 

The Orbiter Docking System (ODS) is also an electromechanically driven system, but its unique nature warrants 
its own section. The ODS consists of an active half and a passive half (the passive half is part of the International 
Space Station). Prior to docking the active ring is extended on the active side to the pre-docking position by driving 
the six ball screws attached to the ring and the Androgynous Peripheral Docking System (APDS) structural housing. 
When docking, the active ring, guided by the 3 guide petals on the active side and the 3 petals on the passive side, 
captures the passive half with the 3 capture latches on the active ring petals that latch onto the 3 passive half body 
latches. Once the motion of the vehicles created by the impact of the docking is damped out with the high energy 
and low energy dampers and the misalignments are taken out by the centering springs, the vehicles are drawn 
together by retracting the active ring with the extend/retract drive mechanism. The retraction of the mechanism 
continues until the ready to hook sensors trigger the closing of the two sets of 6 active side structural hooks (total of 
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12) that engage the 12 passive hooks on the passive side. Each side of the interface has 12 hook assemblies that 
contain a set of one passive and one active hook per assembly. As the closing hooks go through their range of 
travel they also pull the interfaces together and complete the mating of the 4 power/data transfer umbilical 
connectors, the compression of the 2 elastomeric interface seals and the compression of the 4 separation spring 
plungers, 2 on passive and 2 on the active half (called pushers). 
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Figure 2-11: Orbiter Docking System Schematic 


For undocking, the 12 structural hooks are driven open and the pushers push the two interfaces apart with an 
initial separation rate and once the vehicles are separated enough, thrusters are fired to complete separation. 

The docking mechanism is controlled by 9 avionics boxes located in the airlock floor and is operated from 2 
control panels on the aft flight deck. From the aft location the crew can see the approach to ISS through the aft and 
overhead windows as well as the view of the centerline camera aimed through the airlock hatch window. 

L. Manually Driven Mechanisms 

All crew hatches on the Orbiter use a manually driven actuator that in turn drives a linkage train to open and 
latch each individual latch. The number of latches is determined by the hatch application, hatches with pressure 
assisted closing have fewer latches than those where pressure loads are also reacted by the latches. 

M. Pyrotechnically Initiated Mechanisms 

Several mechanisms related devices are initiated by pyrotechnics. The Crew Escape system is composed of two 
systems: hatch jettison and overhead window #8 jettison. The hatch jettison system uses three pyro sub-systems: 
one system to cut the side hatch hinges, one to break the bolts on the hatch collar and mortars to jettison the hatch. 
This system would be used during bailout or in a contingency landing where the hatch mechanism was inoperable. 
For bailout, a separate pyro system is used to vent cabin pressure to the PFB. The Window 8 system uses a pyro 
device to break the bolts holding the window frame to the fuselage, allowing the crew to crawl out of the top of the 
crew cabin. 

The ET is connected to the bottom of the Orbiter at three points: one point on the nose and two on the aft. After 
Main Engine Cut Off (MECO), the ET is jettisoned. The forward separation system uses a pyro device to drive a 
piston, breaking the forward attach bolt. The aft system uses pyro devices to break a frangible nut, releasing each 
bolt at the two locations. The ET fuel lines are connected to umbilicals, inboard of the structural connection. These 
umblicals are also released by firing pyro devices and breaking three frangible nuts on each side. 

N. Hydraulically Driven Mechanisms 

The RSB and Body Flap systems each use hydraulic drives to power an output gearbox, both contained in a single 
unit to make a PDU, that in turn drives rotary actuators with planetary gear sets linked by drive shafts. The RSB 
PDU differs in that it has a mixing gearbox that takes inputs the from the rudder hydraulic motors and speed brake 
hydraulic motor and outputs separate commands for the left and right RSB aero surfaces. 
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O. Landing & Deceleration System 

The Landing Deceleration System is also a hydraulically driven system, but warrants its own section due to its 
several subsystems. These subsystems include: Wheels, Tires, Brakes, Struts, Nose Wheel Steering, Anti-Skid, Yaw 
and Brake Pedals, and the Drag Chute. 

Other related systems which affect the performance of the Landing Deceleration System are the three Primary 
Runways at Kennedy Space Center (KSC) in Florida; Edwards Air Force Base (AFB) in California; and Northrop 
Strip in New Mexico. The now discontinued Overrun Barriers were erected before every launch at two of the Trans 
Atlantic Landing Sites in Spain and France. These were installed for potential use because these overseas abort sites 
have runways which are shorter than the three main 15,000 long primary runways. They were deactivated as a cost 
savings. 

This Landing Deceleration System is a relatively basic system when compared to conventional systems used 
today on commercial airliners and some military aircraft. The differences being in the marginal designs used on the 
Shuttle in order to save weight. Although the tires are a unique design, the struts are typical of other aircraft, the 
nose wheel steering and anti-skid are a relatively old design, the brakes are similar to current new model airliners, 
the yaw and brake pedals are “mil spec,” and the drag chute is similar to the B-52 Drag Chute. 

Although the nose landing gear strut was a typical aircraft design, is has since been realized that this short nose 
gear strut design, selected to save weight and to provide a nose down attitude during rollout and thus produce greater 
down loads on all landing gears to effect higher traction during braking, was a mistake because it was excessively 
short. This drove the downward loads into the main gear struts to nearly twice as high as necessary due to the 
negative aerodynamic lift. This nose gear strut weight savings was lost when compared to the final increased main 
gear wheel and tire weights required to endure the high landing load nose pitch-over load cases. 

Since the tires are unique, it is worthwhile to elaborate more on that item. The original tires were a copy of the 
B-l tire which utilized a relatively light weight carcass, but the first version of the Orbiter tire design intentionally 
utilized a very thin tread made of natural rubber which provides less heat buildup into the carcass during a landing 
and thus this resulted in a stronger Nylon/Natural Rubber carcass. After the first landings at KSC it was recognized 
that the Natural Rubber Tread was inadequate for that very abrasive broom finish and cross grooved concrete 
runway. Steps were immediately taken to use the main tires only once, due to excessive spin-up wear, and to start 
improving the tire by changing the natural rubber tread material to commercial tread rubber and to increase its 
thickness. Through the years the tire pressure was also increased. Finally the latest tire design utilizes no tread 
grooves — the previous grooves provided no wet runway performance advantage, it includes reinforcing nylon cord 
in the tread area to prevent shedding large chunks of tread rubber, the tread thickness has been increased, as has the 
carcass thickness. Additionally, the operational pressure increased nearly 30% between STS-1 and STS-121. These 
increased pressures and carcass strengths were to accommodate increasing landing loads and velocities. Unlike 
airliner tires, these shuttle tires can be operated at twice the deflection (or load) of other tires and still survive. 
Obviously this results in a short tire life, but for the Orbiter this is the most economical approach. 


III. Development-Era Challenges and Lessons Learned 

Many of the development-era (prior to first Space Shuttle launch) challenges for the structures and mechanisms 
team are already documented in technical papers, so the intent of this section is to highlight noteworthy challenges 
not well documented already. Additionally, challenges were selected which had meaningful lessons learned as a 
result. 

A. Primary Structure Sensitivities to Pressure and Thermal Environments 

During the first flights of the Space Shuttle Program, many structural modifications had to be made in order to 
maintain the required 1.4 structural factor of safety. For example, under-estimated environments required 
subsequent structural enhancements along with the associated updates to the analysis. Some examples of some the 
various components that required structural modification are listed below: 

• Primary Structure Bulkheads 

• Base Heat Shield 

• Mid-fuselage and Aft fuselage frames 

• Aft fuselage OMS Pod interface 

• Payload Bay Doors, including the hinges 

• Mid and Aft Fuselage skin 
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As mathematical models and definitions of the environments matured, many structural enhancements were 
required to eliminate areas of negative margin (below the 1 .4 factor of safety) and problems noted during post-flight 
inspections. This might have been avoided by using more conservative pressure deltas during the initial design 
phase. Although this would have added weight initially, it also would have resulted in a more efficient design. 
Instead, the existing design had to be repeatedly altered with local modifications to the structure itself (which can 
often results in an inefficient design). 

Another example is provided by the outer skin design of the mid-fuselage, which initially had a relatively low 
compression allowable. Fifty to sixty percent of the total load in the panels is due to thermal stress caused by 
temperature gradients. If considerably higher compression allowables had been used for the initial design of the 
outer skin, the structure would have been less sensitive to the thermal stress variations. 

Lesson Learned: 

1. Set realistic ascent/descent performance requirements, and maintain margin to be used for potential future 
problem areas. 

2. Use appropriate uncertainty factors for poorly understood environments to protect against costly design 
modifications as the program knowledge matures. For example, gravity and pressure loads might have a factor 
of 1.0, but dynamic and aero loads (if not as well understood) might have higher factors, depending upon the 
level of confidence in the environment. This method could be used as a form of structural margin management if 
development time is short, thus avoiding potential costly hardware changes as loads analyses mature. 

B. Thrust Oscillation Response (“Pogo”) Challenge 

Every NASA manned launch vehicle before Shuttle has had some degree of longitudinal oscillation associated 
with the launch. Astronaut Mike Collins, who is quoted as stating, “The first stage of the Titan II vibrated 
longitudinally, so that someone riding on it would be bounced up and down as if on a pogo stick”, described this 
oscillation. Thus, the term, “pogo,” became the ad hoc nickname for this phenomenon throughout the rocketry 
engineering community. 

The Space Shuttle was the first NASA program to address the pogo issue in the early stages of the program. 
This action involved the creation of a Pogo Suppression System Design Team that developed, tested, and verified 
that the Shuttle was pogo free during all phases of powered flight. The Shuttle Program identified the potential pogo 
threat and addressed the issue early on by baselining a pogo suppressor as part of the Space Shuttle Main Engines 
(SSME) between the low and high pressure liquid oxygen turbopumps. The suppressor itself is a basketball sized 
container filled with hot gaseous oxygen for the majority of flight. It attenuates liquid oxygen flow oscillations in a 
critical low frequency band of the high pressure turbopump, and in turn, prevents pogo. 1 

Pre-flight predictions and post flight data (pressure and targeted acceleration measurements) for the initial shuttle 
flights indicated a pogo-free vehicle. Though well addressed early in the program, pogo stability was continuously 
monitored in the Space Shuttle Program until the end via payload changes, SSME upgrades, structural modifications 
and any other system changes that could affect the pogo stability of the vehicle. 1 

Lesson Learned: 

1. Using lessons learned from previous programs, identify significant engineering design challenges early, and 
implement a plan to thoroughly address them lest unnecessary operational limitation be imposed. 

C. Crew Module Misaligment 

During an investigation in the 1990’s to determine whether the window barrier, a Nomex and RTV flexible boot 
that spans between the redundant and thermal windows, could be used to control the pressure in the window cavity, 
some Rockwell engineers pointed out that the barriers had to be redesigned to accommodate a misalignment 
between the forward fuselage and the crew module. 

During original build, when the crew module was installed into the forward fuselage, the four links that attach 
the two structures were adjusted to ensure that the two part ingress/egress hatch and hinge mechanism functioned 
smoothly. In the course of making these adjustments, the windowpanes that were mounted on the crew module 
became misaligned from the thermal panes, mounted on the forward fuselage, by as much as one inch. This 
misalignment was not identified until attempts were made to install the window barrier when the bolts on the 
thermal pane side did not properly align with the forward fuselage window frame. When engineers in the 1990’s 
went to investigate the extent of the problem through NASA’s discrepancy system, they could find no evidence of 
the forward fuselage-crew module misalignment documented in that system. The reason for this was because the 
misalignment was only documented as the “cause” for the window barrier misalignment; it was not identified as a 
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problem in and of itself. This made it very difficult for engineers in the 1990’s to determine how misaligned each of 
the Orbiter crew modules were, and thus, very difficult to understand just how much “stretch” the window barriers 
were under when mounted in the vehicles. 

Lesson learned: 

1. When major design “causes” for issues are identified, the discrepancy system should be used to properly 
document that major issue separately in the system. 

2. The “cause ” could also manifest itself in effects in other areas, and without a unique document identifying 
it, those other effects may never have the proper cause identified. 

IV. Operations-Era Challenges and Lessons Learned 

Once the Space Shuttle Program entered into operational mode (technically after STS-5), the structures and 
mechanisms team continued to learn from the system through new observations, unusual trending or outright 
failures. Again, while many of these lessons learned have been documented elsewhere, the purpose of this section is 
to shed light on some of the lesser known challenges and solutions developed. 

A. Limit Switch Challenges 

The limit switches used in electro-mechanical actuators for the Space Shuttle Program are precision, snap action, 
single pole, double throw (SPDT), hermetically sealed, limit type. The majority of the operational challenges with 
these limit switches focused around two areas: rigging and providing true indication of status. 

One recent rigging issue involved the MRL, a latch used in six locations to retain either the RMS or the OBSS. 
The limit switches control power to the MRL PDU and provide MRL position indication. There are two redundant 
limit switches for the MRL closed position and two redundant limit switches for the MRL open position. All four 
limit switches are actuated by spring loaded levers that follow a gearbox cam and the two redundant switches should 
transfer almost simultaneously (with a small variation due to hysterisis and rigging tolerances). Typical actuation 
force is six pounds. 

Three new built MRLs, built to support the addition of the OBSS for Return to Flight, were found to have dented 
limit switches during the investigation of a separate issue. Further investigation strongly suggested that the limit 
switches were dented during initial assembly and rigging. This allowed the limit switch actuation mechanism in the 
actuator to over-travel, denting the “can” of the limit switch, which required approximately 40 pounds of force. 
Limit switches with dents of 0.018” or less were determined acceptable for use with the remaining switches being 
scrapped. 

A situation regarding true indication of status is provided by the ET door system. The ETD system is comprised 
of three sets of actuators: Centerline Latch (holds the doors open during launch), Door Drive and Uplock Latch. For 
all three of these actuators, the limit switches giving final indication of position were internal to the actuator. During 
the investigation of an unrelated issue, review of the stress analysis of the Uplock mechanism showed that the 
capability of the torque limiter exceeded the load capability of the downstream linkages and mechanism. If the door 
was placed in a jam condition, the uplock actuator could yield linkages and / or uplock hooks. This would result in 
the door position being “out of time” with the limit switches internal to the Uplock Actuator. The limit switches 
would indicate that the door is closed and latched, however, that would not be the case due to the yielding of the 
downstream hardware. This failure mode was particularly problematic as this door is on the underside of the Orbiter 
and is exposed to the high temperature flow during Orbiter re-entry in to the atmosphere. 

Lessons Learned: 

1. A good understanding of initial assembly and rigging requirements is essential to avoid potential hardware 
damage. 

2. Placing limit switches that provide position indications external to an actuator (i.e. on the feature of 
interest, not the motor driving the feature) will provide a more reliable indication of status. 


B. Beryllium to Carbon Brakes Modification 

The original brakes flown on the Orbiter were a Carbon Lined/Beryllium heat sink design. Although these brakes 
were capable of stopping the Orbiter during normal landing operations, they were subject to some sort of failure 
mode or damage on nearly every flight until many design modifications were implemented which finally resulted in 
the Thick Stator version which resulted in little or no damage. 
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During the earliest days of Orbiter Brake development, the vendor attempted testing both the Carbon 
Lined/Beryllium as well as the Structural Carbon Brake concepts. Each design presented its failure modes, and no 
other option was available except for the conventional Sintered Iron lined Steel Brake concepts flying on current 
aircraft at that time, which were excessively heavy. The weight saved by utilizing the Beryllium heat sink design 
proved to be the most promising. This was in part due to the use of beryllium heat sinks on both the C-5A as well as 
the F-14, but these brake designs utilized sintered iron linings which, when used at low energy levels, were more 
forgiving. In addition, the Orbiter Brake required such high performance, when compared to conventional aircraft 
steel brakes, that we should have expected many development problems. The major problem was with the 
attachment of the thin (—1/8” thick) carbon linings. These attachment concepts were fragile, and any unwanted 
brake dynamics effects would quickly destroy some part of these attachment devices. In addition, carbon linings 
could operate at much higher temperatures than sintered iron linings, and this in turn would damage the beryllium 
heat sink by melting or weakening it where dynamics problems would cause the heat sink to fail, and if it were a 
cracked stator, lockup was almost a certainty. When all of the major landing gear components were used in an 
integrated systems test — including the dynamics or flexibility of the main gear strut, the flexibility of a thin walled 
axle, plus the dynamics of a poorly implemented anti-skid system, then brake damage was an immediate and 
obvious result. NASA knew that this spelled flight problems, but we erroneously convinced ourselves that this 
brake damage was acceptable and went ahead with Approach and Landing Tests on the Edwards Dry Lake Bed as 
well as with the first Shuttle flights into space. Brake damage occurred on nearly every flight, and on some flights 
where the brake energy was relatively high, brake lockup occurred, such as on STS-5 and eventually on STS-51D 
where the lockup lasted long enough to fail one main tire. The brake damage was caused by “whirl” or chatter. The 
combined Landing Gear problems were a perfect setup for brake self destruction or damage. 

The brake damage was such a major Orbiter operational problem, that NASA realized that it must take drastic 
steps to correct the design, so a large committee was formed in the early 1980’s to resolve the many design 
problems. This was commonly called “The Orbiter Ad Hoc Braking Committee.” In attendance were top 
management officials from the JSC Center Director down to engineers from NASA Headquarters, other NASA 
centers, and with engineers from every major airframe manufacturer in the USA. These meetings, occurring over a 2 
year period, resulted in: starting a new design for Carbon Brakes, implementing interim fixes for the Beryllium 
brakes, changes to the Anti-Skid response, stiffening the main gear axles, the addition of hydraulic orifices in the 
brakes, and recommending that the crew start using the already available nose wheel steering instead of steering 
with differential brakes, which often overloaded brakes on the upwind side of the vehicle. 

By the time that the new Structural Carbon Brakes were implemented on STS-31, the highly modified Thick 
Stator Carbon Lined Beryllium Brakes were performing very well, with little or no damage. Even so, with no Drag 
Chute in operation at that time (it was installed on STS-49), it was realized that the Beryllium brakes were 
inadequate and that brakes with more capability were needed, so the Structural Carbon brakes came at a good time 
and, fortunately, they cost about % as much as the Beryllium design. 

The original Beryllium brakes were a 4 rotor concept producing a maximum energy absorbing capability of 55 
million foot-pounds (FT-Lbs). The new Structural Carbon Brakes were a 5 rotor design with a maximum energy 
absorbing capability of 82 million FT-lbs, and a demonstrated off limits capability of 100 million FT-Lbs. 
Obviously, the new brakes were a welcome relief to the problems and costs we had been experiencing in the past. In 
addition, their high energy absorbing capability gave us confidence that these brakes could endure most any 
foreseeable circumstance including nose up braking or steering with brakes. These carbon brakes are: relatively 
inexpensive, nearly trouble free, they wear very little, were inspected every 8 flights for any problems, and then 
were reinstalled for additional flights. With the exception of the Improved Main Tire and addition of the Drag 
Chute, the implementation of the Structural Carbon brakes was one of the most successful improvements made to 
the Landing Deceleration System. 

From a safety point of view, the Structural Carbon Brakes are also an advantage. Since the Carbon can operate at 
such very high surface friction temperatures (3,000+ deg F), they will maintain its function in a worst- worst case 
scenario and deliver stopping torque, by not fading, even though some parts around the brake may be melting at the 
same time. In addition, with protective heat shields inside the wheels, these brakes will not allow a tire fire to start 
until the energy has exceeded 70 million ft-lb, a great advantage over the beryllium brake which could have allowed 
a tire fire to start at 55 million ft-lb. 

Lessons Learned: 

1. Do not assume that dynamics problems (brakes, in this case) can easily be solved once operational flights 

have begun. 
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2. Do not assume that only one contributor is the cause of a brake dynamics problem. It turned out to be 

several problems indicating a lack of realistic systems integration testing. 

C. Access Door Challenges 

The Orbiter airframe was designed with numerous openings in the outer mold line to provide for propellant 
servicing ports and main compartment access to service critical sub-systems hardware. The passive nature of the 
structural sub-system would not appear to lend itself to issues during critical path vertical operations and pre-launch 
countdown activities. However, each of these access points requires structural doors to close-out the opening using 
fastening systems that are highly susceptible to wear out due to the numerous installation & removal cycles 
demanded by a re-usable launch system. Since many of the sub-systems require late access for propellant loading, 
system pressurization, or other processing requirements, problems with these passive door installations could 
ultimately impact critical launch milestones. Retracting ground system access platforms are a critical milestone that 
occurs within the launch countdown. Roll-back of the Space Shuttle launch pad’s Rotating Service Structure (RSS), 
which provides primary access to these external servicing doors, is a prime example. If access door issues requiring 
fastener replacements or repairs are found late in the vertical operations, and the design does not lend itself to easily 
remove and replace (R&R) the discrepant hardware, Material Review Board (MRB) engineering must be engaged to 
develop repair options with a short timeline to implement. 

Door attach fastener issues were common on the Space Shuttle Orbiter, as the original design did not provide the 
ability to easily remove and replace these fastening systems real time at the launch pad. Additionally many factors 
contributed to an unexpectedly high wear rate which resulted in frequent ground failures of the fastening systems. 
Real time workarounds were developed to help mitigate these issues but frequently required last minute analysis 
efforts and repair procedures which resulted in Foreign Object Debris (FOD) (receptacles) being left inside the 
Orbiter compartments during flight. To complicate matters many of these access door fasteners were shared 
fasteners with the critical thermal protection system (TPS) carrier plate that was installed over the access door, 
requiring both thermal and structural analysis efforts and repairs. Although no RSS roll-back or launch was ever 
slipped due to this type of issue, there were many occasions when a servicing and / or access door was flown with 
less than the required number of fasteners due to insufficient time to repair or replace. 



Figure 4-1. Typical Propellant Servicing Opening & GSE Scupper Installation. 

Fastener receptacles for Door Installation are Inaccessible for R&R 

The main design feature that drove most of these issues revolved around the use of a servicing panel/ servicing 
well at each of the propellant servicing openings. The servicing well was installed behind the propellant ports and 
closed out the external opening so that none of the hazardous commodities could propagate into the interior vehicle 
compartments. The unwanted side effect of this design is that the servicing well also closed out the access to the 
receptacles used for the servicing door installation. Thus if a receptacle failed, the only available access to remove 
and replace it was through the interior of the vehicle which required significant internal access and does not lend 
itself to a launch pad/ vertical operations event timeline. A better solution would have been to keep the receptacles 
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on the external side of the servicing well/ pan so that they could be replaced externally from the same area. Also 
many times when a failed fastener receptacle needed to be replaced it required replacing the entire receptacle 
(drilling out and installing new rivets). A better solution is to use replaceable nut element receptacles, if available 
for the particular fastening system, wherever high cycle or late installation of access doors occurs. 

Most of the access door fastening systems had a failure rate higher than the designers anticipated and there were 
many contributing factors. The requirement for a secondary locking feature was accomplished by using crimped 
nuts within the receptacles or deformed threads within the structural panel fastener sleeve bolt. These mechanical 
systems have a limited number of cycles prior to wear out. For the Space Shuttle system these receptacles 
experienced a higher than expected number of cycles due to numerous access door installations and removal 
required for each ground processing flow. In addition ground service equipment (GSE) scuppers are attached to 
these same receptacles. The GSE “scupper” is a box that is attached to the vehicle opening and serves as spill 
containment (similar to the vehicle side service well) and supporting structure to carry the loads from the servicing 
lines and valves. These additional scupper installations add more cycles to the receptacles during ground processing 
and contribute to the high wear rate. A design solution to help mitigate this issue could be to locate the secondary 
locking feature on the fastener itself, and not the receptacle, such as a locking patch on the fastener threads. This is a 
similar approach to the structural panel fastener (Milson) which has the locking feature on the screw side. Thus 
when the locking feature wears out the fastener can simply be replaced, instead of the receptacle. This concept was 
successfully implemented on the Space Shuttle for fasteners attaching the TPS carrier plates around the Orbiter 
windows due to frequent complications with their receptacles. 

Another factor contributing to the failure rate is the weight and size of the access doors. If the door is 
cumbersome due to weight and/ or size, and it must be handled manually, by one or multiple technicians, there is 
high probability that alignment issues will occur during installation. Using the attach fasteners to pull-up or align the 
doors during difficult installations can impart side loading on the receptacle resulting in premature failure and could 
also result in structural hole elongations. In these areas a good design solution is to utilize alignment pins to support 
the weight of the access panel during installation and maintain fastener alignment. 

In summary, there were many operational challenges associated with external access and servicing doors and 
these challenges were primarily related to requirements for late access at the launch pad when sensitivity to repair or 
replacement work is high. There is not one single design solution to address all of these challenges but there are a 
number of lessons learned from the Space Shuttle program that can be combined together to alleviate much of this 
problem for future launch vehicle processing. 

Lessons Learned: 

1. Design fastening systems using a screw and nut, so they can be readily replaced externally directly at the 
access opening. 

2. Use replaceable (< high re-use” nut elements in receptacles. 

3. Use a locking device that is located on the fastener side instead of within the receptacle. 

4. Design-in dedicated GSE attach points for ground servicing attachments. 

5. Use Guide Pins to maintain alignment during fastener installations. 

D. Runway Roughness 

Runway roughness for the Orbiter has to do with the runway surface finish which causes tire wear, and is not the 
same as the term called runway roughness which regards runway leveling and has more to do with vehicle bouncing 
producing dynamic tire loads. 

The original KSC runway was constructed of concrete, made 15,000 ft long by 300 ft wide, had a slight crown 
the first 25 feet from the centerline and then continued with a more pronounced crown for the remaining 125 feet to 
the edge of the runway. The surface finish was a broom finish with cross grooving. The broom finish caused the 
major problems regarding wear, so this surface was subsequently called the “cheese grater” and rightfully so. Even 
tour busses which frequently carried tourists on the runway found that this surface was producing excessive tire 
wear for them. When the Orbiter rolled straight down the runway during a landing it left gray “ghost tracks” 
indicating that a small amount of tread rubber was being deposited on the runway due to typical tire tread “squirm” 
in the tire’s footprint. 

The Shuttle Runway was originally designed with several primary goals in mind. First it needed to have 
excessive length and width for high velocity and high cross wind landings, secondly it needed necessary crown and 
cross grooving to facilitate rain water drainage, and finally it needed a very abrasive finish to provide adequate 
traction for hard braking whether wet or dry. This very abrasive finish turned out to be an overdesign feature which 
produced an undesirably aggressive wear surface, causing excessive tire wear during spin-up as well as during 
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rollout. The crown and cross grooving were a good idea which allowed the runway to quickly drain off the 
rainwater and leave the damp surface with a nearly dry runway traction effect. During the early program years, the 
Orbiter Main Tires had to endure excessive spinup wear, sometimes into 3 or more cord layers of the inner carcass 
plys of which there were only a total of 16 cord layers available for the excessive fatigue loads which every main 
tire endured. The Nose tires were not subject to such excessive loads and velocities. The Main Tires were used only 
once because nearly 1/3 of all main tires were damaged internally upon landing — this damage could not be found by 
external carcass visual inspection, so it was more economical to discard every main tire rather than try to prove that 
it might safe for reuse. 

The original tire wear predictions were off target due to an unexpected phenomenon. The wear rates were 
initially obtained at the Langley Landing Loads track, which was only 1,800 feet long. Here, loads, velocities, yaw 
angles, and surface finish were studied and measured very accurately, and the wear rates for KSC were thusly 
predicted. When the real wear rates at KSC turned out to be nearly twice as severe as predicted, it was finally 
theorized by Michelin Aircraft Tire engineers that the problem was with realism at Langley. It was later found, for 
instance, that the wear rate on the Edwards smooth, non grooved, burlap drag finish, concrete runway surface, could 
be greater than the final version of the relatively rough KSC Runway surface due to this heating effect. So later in 
the program, the wear rates were accurately measured later by using the Convair 990 Landing Systems Research 
Aircraft from Edwards Air Force Base which tested a Orbiter tire, mounted in its belly, at perfectly realistic 
conditions of load, distance, velocity, yaw angle, and surface finish. 

The high tire wear rates seen during the early 1980’s resulted in tire tread changes which helped some. The tread 
material was changed from natural rubber to commercial tread rubber to reduce wear rate, and the tread thickness 
was also increased. This natural rubber was originally chosen because it ran cooler than commercial tread rubber, 
thus providing a stronger tire carcass for high radial and cross wind loads, but it was poor for wear. 

During the late 1980’s it was realized that the runway must be modified to reduce spin-up wear, so the first 3,500 
feet from each end of the runway was longitudinally ground with abrasive blades producing what was called a 
corduroy touchdown zone. This grinding removed all of the cross grooving in this spin-up zone. The 8,000 ft. long 
center section was left as it was with the broom finish and cross grooving intact. Tire wear continued to be a major 
problem. It was so bad, that flight rules were imposed allowing the carcass to become worn through 6 of 16 ply 
layers in a 34 ply rated tire. If pre landing conditions due to tire load, velocity, crosswind, and steering predicted 
that wear would exceed this amount, the landing would be waived off. 

In the early 1990’s it was decided that the runway needed additional modifications to prevent further spinup and 
rollout wear, so a team was formed to correct this problem. Many different measurement methods were employed 
to study the entire runway surface finish effects. These included: Mu meter (tire friction device towed by a 

motorized vehicle), Instrumented Tire Test Vehicle (28,000 lb truck with a test wheel/tire mounted on rear), Landing 
Systems Research Aircraft (Convair 990 modified with a test wheel/tire in its belly), British Pendulum Tester 
(swinging pendulum with a rubber foot pad), Skid Traction Vehicle from Florida Highway Department, Outflow 
meter (measures surface macrotexture using water flow bypassing a rubber doughnut), Grease Sample Tester 
(measures quantity of grease smeared across the peaks and valleys of a concrete surface which obtains a surface 
finish value) and Computerized Tomography (X-Rays passing through the cross section of a test tire). 

The most realistic tire wear studies and those having the greatest impact were probably provided through the use 
of the Landing Systems Research Aircraft (Convair 990). Ten foot wide sections of the KSC concrete runway 
which were several thousand feet long, were ground, treated, shot peened or shot blasted to provide test sections for 
the Convair 990 to conduct its tire wear tests on. This required a high degree of piloting skill, but the NASA pilot 
consistently landed on and held within these narrow test strips. The detailed results of these tests showed that the 
entire runway should be shot blasted by a process known as Skidabrader. This effort was completed in 1994 and the 
first Shuttle flight using that surface was STS-68. 2 

In summary this KSC Shuttle Runway has progressed from its original concept as “the very best runway 
available for the astronauts” to one which is customized for Orbiter landings only and is probably the only unique 
multifmish runway in the world. 

Lessons learned: 

1. True tire wear is must be determined through a totally realistic set of test conditions which include: actual 

tire construction exposed to realistic dynamic loads, velocities, yaw angles, and rollout distances on a realistic 

runway surface. 

2. The smoothest runway surface can sometimes produce more tire wear than an apparently rough surface. 
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E. Firing Forward RCS Jets to Relieve Window Hazing 

In the early 1980’s, engineers noticed that the forward facing windows of the Orbiters were accumulating a haze 
during flight. After an investigation, it was concluded that the haze was a surface contaminate that would need to be 
removed after each flight. A removal process was developed, called “polishing,” that used cerium oxide to polish 
off the contaminate. This hand method was laborious, tedious, and slow, but necessary to ensure no damage would 
be incurred on the surface of the pane. A method of evaluating the success of this polishing task was developed 
using an Air Force Resolution chart and photo-optical pass/fail criteria. 

After a decade of polishing windows after each flight, a re-assessment was made on the character of the window 
haze in 1995. It was noticed that the haze was aerodynamic in nature; the haze was not evenly distributed across the 
pane surface, and had certain classical aerodynamic features. An examination of the haze micro-characteristics by 
Southwest Research Institute concluded that the haze was not a particulate/contaminate on the surface of the glass, 
but a microscopic pitting on the surface of the glass. This was a “frosting” effect on the glass surface, which meant 
that it was cumulative surface damage. 

The Window Problem Resolution Team proceeded to identify the source of this hazing. After investigating a 
variety of potential sources, the team concluded that the only viable source of the micropitting was the solid rocket 
booster separation motors. This conclusion raised consternation outside the window community, as the 
aerodynamicists and SRB engineers maintained that the SRB sep motor plume was not capable of reaching the 
Orbiter windows. 

After some negotiating and discussions, the Boeing window subsystem manager convinced the Boeing 
aerodynamicists to take a closer look at the problem. At the completion of this investigation, it was concluded that 
there was a possibility that larger particulates from the SRB sep motors might be “ejected in front of the vehicle” 
where the windows could impact them. The Boeing SSM then asked the team to look at the possibility of re- 
directing the sep motor particulates over the vehicle canopy by firing the forward reaction control system upward 
facing motors at the same time. This evaluation was completed and indicated that if there were particles present in 
front of the windows, then the FRCS motor would propel them out of the way. 

Boeing proposed this idea to the NASA responsible design engineer. Because implementing this idea would 
involve so many organizations, it was considered a difficult proposal to implement. The FRCS team would have to 
agree to perform this maneuver, as they had expendables to account for. The flight software had to be changed to 
implement the action automatically. The GNC and aero communities had to agree on the effects of firing the FRCS 
motor during ascent. The structures community had to evaluate the effect of the firing through the structure. At the 
same time, there was still considerable doubt cited as to accuracy of the conclusion that the window haze was caused 
by the SRB sep motors. 

After many discussions, evaluations, and a presentation to the Orbiter Configuration Control Board, the proposal 
was approved. This was just in time to make a GNC software update deadline that was already in work. The 
software team made a two-line change to the software that would fire the up facing FRCS thruster one second before 
the SRB sep motors fired, and last for 2 seconds. 

During the months while the analyses were performed to verify this modification for ascent, the window team 
replaced the forward windows with fresh panes to get a baseline measurement on the amount of haze acquired from 
one flight worth of SRB sep motor plume impingement. This would provide the criteria for evaluating the success 
of the FRCS firing. 

The first flight of the FRCS firing was on STS-98 in February 2001. Prior to the launch of this vehicle, the 
forward windowpanes were replaced with fresh panes. Upon return of this flight, measurements of the haze effect 
were taken. The results indicated that the FRCS firing was 100% successful in deflecting the SRB sep motor plume 
away from the windows, thus paving the way for four significant outcomes. 

The first was inarguable proof that the window hazing was being caused by the SRB sep motor plumes. The 
second was the successful mitigation of the plume impingement on the windows, which in turn prevented the 
structural degradation associated with the plume damage. The final outcome was to save an estimated 400 man- 
hours of window polishing labor during the turn around of the Orbiters. These significant outcomes came at the cost 
of a simple software code change and the use of some spare propellant for the FRCS (which was typically dumped 
prior to vehicle entry if not used during the mission). In the years since, this simple modification has cumulatively 
saved the Shuttle Program millions of dollars in processing labor and the replacement of window panes. 

Lessons Learned: 

1. Before designing a solution to minimize damage potential from a known environment, consider means of 

changing the environment itself 
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2. Sometimes, the most elegant solutions present themselves as the most unlikely of ideas with the most 

significant problems to resolve. 

F. Docking Capture Latch Manual Release Issues 

During the final portion of the capture ring retraction phase of the STS-1 14 docking, an indication was received 
that the manual release handle had opened on one of the three capture latches of the docking system. The manual 
release handles provide a means of releasing capture in the event the capture latch mechanisms fail in the closed 
position, but because this anomaly occurred near the end of retraction, docking was completed successfully. 

Subsequent investigation showed that the manual release handle did in fact become unsecured and begin to open. 
It was also determined that permissible docking loads could cause a capture latch in such a configuration to back 
drive to the fully open position and that having a capture latch open prematurely could lead to potential loss of 
docking capture during retraction or failure to achieve proper alignment for completion of structural latching of the 
docking tunnel. The avoidance of these more serious consequences was essentially due to good fortune. Detailed 
investigation did not conclude with a certain determination of the cause, but indications pointed to the likelihood of 
a ground processing error having placed the manual release lever in an unsecured state prior to launch, which 
rendered the manual release susceptible to opening under applied docking loads. 

As with many of the elements in the APAS docking mechanism, heritage of the capture latch design traces from 
the Apollo-Soyuz docking project of the 1970’s to the Soviet Buran shuttle program, and finally to the Shuttle-Mir 
and ISS programs, with the basic design concept of the latch originating at NASA/JSC but going through the later 
design evolutions at the Russian design bureau / company RSC/Energia. The manual release mechanism and handle 
were added to the original design to meet new requirements as the mechanism was evolved for the subsequent 
programs. 

The manual release handle is held in the secured position during normal operations by two spring loaded 
retention buttons designed for easy operation with gloved hands. The handle is subject to a slight opening force 
when in the closed position due to compression of the spring in the micro-switch used to sense the status of the 
manual release handle. Investigation of the STS-1 14 incident revealed that the retention buttons meant to secure the 
manual release handle in the closed position could actually become trapped by the handle due to the micro-switch 
spring force and the smooth dome button shape. Investigation showed that with the retention buttons in such a 
trapped configuration, the release handle is in a position that does not give electrical or mechanical or readily 
apparent visual feedback of being unsecured. Preflight procedures called for verifying the latch to be secure, but a 
subsequent final cleaning procedure listed instructions that could potentially have lead to the retention buttons being 
unwittingly placed in the trapped configuration without any positive indication of having become unsecured. 

Study of the design heritage showed that the original Apollo-Soyuz design (prior to implementation of the 
manual release) drives the capture latch between open and closed configurations with a collapsing linkage that holds 
the latch in the closed position via an over-center link. The latch is placed in the open configuration when the drive 
motor moves the linkage so as to defeat the over center lock thus enabling opening loads to force the latch open. The 
manual release handle of subsequent design iterations attempts to achieve the same function by providing a manual 
means of directly moving the over center link to a geometry that defeats the over-center lock. To accomplish this, 
the over -center link was mounted on an eccentric shaft that is rotated by the manual release handle. However, the 
range of motion provided by the eccentricity to the linkage is only a fraction of that necessary to enable the latch to 
be opened by the specified opening loads. Interviews with RSC/Energia personnel indicated that this deficiency was 
resolved by adding a feature to the handle that directly pushes the linkage completely into the defeated 
configuration. Thus proper retention of the manual release handle is necessary for the latch to support the design 
loads of the closed configuration and the handle and its retention buttons are integral elements in the normal load 
path of the latch. This issue was not understood by the operations support community prior to the in-flight incident. 
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Figure 4-2: Capture Latch Assembly 

The proximate chain of events in the STS-1 14 incident most likely started with a post inspection cleaning prior 
to launch that unwittingly forced the manual release handle retention buttons into an unsecured configuration, which 
did not provide adequate retention force on the handle to constrain it to the closed position when normal docking 
loads were applied to the latch and back through the latch (non) over-center linkage to the handle. Nor was the 
unsecured configuration detectable by the pre-flight and pre-docking procedures in place at that time. As the 
docking retraction neared completion, the loads on the capture latch became sufficient to move the release handle 
against the remaining spring force induced friction of the retention buttons far enough to open the micro- switch, thus 
triggering the anomalous telemetry signal. However, the loads on the capture latch remained sufficiently below 
limits to avoid back driving the capture latch manual release to the fully open configuration, thus permitting 
completion of nominal docking operations without corrective action. In any event, in this case the manual release 
indication came on immediately prior to the final phase of docking and did not affect operational decisions. 

Due to the limited number of remaining missions, it was deemed impractical to implement a design change as a 
corrective action. Recurrence of the incident was precluded through specific training of the flight preparation 
technicians and quality inspectors to recognize the unique failure mode vulnerability and to have awareness for its 
manifestations. Additionally, pre-flight photo documentation procedures were greatly enhanced to enable 
photographic determination of the final status of the manual release handle retention and flight preparation 
procedures modified to require concurrence of cognizant engineering personnel with interpretation of the 
photographs. 

This incident led to the discovery of some rather interesting root causes. The design of the retention buttons is 
readily susceptible to being trapped in an unsecured configuration that can support sufficient load to mask the failure 
but not the full design loads. The design of the retention buttons in concert with the micro-switch spring as a system 
makes the handle susceptible to the unsecured configuration under normal handling not intended to actuate the 
buttons. The design of the retention buttons and their mating features on the manual release handle strongly masks 
the visual and tactile indications of the unsecured configuration. Most importantly, the long and convoluted design 
evolution history between multiple designers in multiple countries working to varied mission applications over a 
period of decades allowed for confusion of design intent. This led to a modified design that functions differently 
than the original version and differently than its apparent design function, but which lead to the introduction of a 
hidden design weakness that was not understood by the cognizant design community and had a potential for 
unrecognized failure modes. Furthermore, this unrecognized vulnerability resulted from a peculiar combination of 
subtle design features of multiple components and pre-flight procedures rather than a single flaw. The convoluted 
design heritage and operational responsibility of the capture latch system inhibited the ability of the investigators to 
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determine the nature of the failure from design documentation alone such that understanding the failure mode was 
possibly only via disassembly and testing of like hardware and discussions with the original designers. Finally, 
contrary to prior thought, the three capture latches do not provide redundancy as failure of a single latch under 
normal loads can lead to a failed docking attempt, thus making the overall design zero fault tolerant for mission 
success, or possibly even critical failures given the dangers of loss of capture during docking. The net result was an 
in-flight anomaly that fortunately ended well, but had the potential to end disastrously without any additional points 
of failure. 


Lessons Learned: 

1 . Vulnerability to failure can result from a subtle combination of characteristics of separate components and 
procedures, not just a single flaw or failure. Multi-organizational projects and programs should be keenly 
aware of this. 

2. Using off-nominal tests to reproduce in-flight anomalies can reveal new failure modes and identify lower 
levels of fault tolerance in a system that may be otherwise considered well tested and understood by the 
technical community. 

3. Ensure that critical configurations of the system are measurable and detectable at all times. 


G. Structural Sensitivity to the STS-117 TPS Blanket Damage and Repair 

During the first day of the STS-117 mission, astronauts on the flight deck observed that a thermal protection 
blanket was lifted from its original position on the OMS pod. Thermal blankets are used to protect structure from 
high ascent and re-entry heating in locations where temperatures will not be as great as the wing leading edge or the 
Orbiter underbelly. Even though having a blanket for thermal protection in this area might imply that this damage 
would not be a high concern (blankets are typically used in areas of the vehicle subjected to lower temperatures than 
those covered with the high temperature tiles or reinforced carbon-carbon), account must be taken of the underlying 
structure’s sensitivity to thermal loads. In addition, the nearby black tiles transitioning to white tiles transitioning to 
the blanket indicates a large gradient in aeroheating, and the lifted blanket would change the aeroheating around it. 
(Figure 4-3 a) 



a) From light deck photo 



b) Closeup 


Figure 4-3. STS-117 Damaged Blanket on OMS Pod. 

The structure underlying the damaged area is graphite epoxy, honeycomb composite. A critical failure mode for 
material under elevated temperature is honeycomb core burst. High temperatures can cause pressure in the cells to 
rise, eventually bursting the graphite epoxy facesheets off of the honeycomb. The pressure at which burst can occur 
for nominal conditions was determined by testing, and is a function of core humidity, mechanical loading and 
temperature. At the predicted core humidity, development testing allowed for a core pressure of 35.7 psi at 
temperatures up to 250° F. Using the limited data available for off-nominal conditions, conservative real time 
analysis set the average core temperature limit at 262° F. During the mission, limited additional testing showed that 
the graphite epoxy itself begins to degrade at approximately 400° F. 

While the Orbiter was on-orbit, it could not be determined how much sub-insulation remained on the structure 
and how much stayed attached to the blanket (Figure 4-3b). If no substrate insulation remained on the graphite 
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epoxy facesheet, with the 1.5” high blanket protuberance increasing the local aeroheating, temperatures reaching 
-900° F were predicted. If .5” of sub-insulation was retained on the facesheet, then temperatures could reach -400° 
F. Given that both of these temperatures exceed the limit of 262° F, an astronaut performed a repair of the damaged 
blanket during an extra vehicular activity (EVA) (Figure 4-4). 

When evaluating structural designs, it is important to consider all potential combined mechanical and thermal 
loads. It is also important to realize that the region of peak heating is not necessarily the region where the lowest 
structural margins exist, due to combined thermal and mechanical loads. Lesser heating can cause significant issues 
on structures which can only take lower temperatures, especially in off-nominal, damaged configurations. It is also 
important to not only test new structural designs to failure under mechanical loads, but also test to failure under 
thermal loads. Off-nominal conditions will occur in any long duration program, and margin assessments will be 
required. Without knowing both mechanical and thermal material properties and ultimate failure loads, these 
assessments are very difficult. In particular in STS-117 the lack of this information during the mission led to a 
conservative temperature limit of 262° F. Subsequent thermal testing demonstrated that under the reentry pressure 
and shear loading, the core burst temperature is significantly higher, and that the repair may not have been required. 



Figure 4-4 Repair that Astronaut Performed during STS-117 


Lessons Learned: 

1. It is important to consider all potential combined mechanical and thermal loads while performing flight 
margin assessments 

2. The region of peak heating is not necessarily the region where the lowest structural margins due to thermal 
loads are (especially in off-nominal, damaged configurations, lesser heating can cause significant 
problems in structures which have lower thermal capability) 

3. It is important to not only test new structural designs to failure under mechanical loads, but also to test to 
failure under thermal loads 

a. Off-nominal conditions will occur in any long duration program, and margin assessments will be 
required 

b. Without knowing both mechanical and thermal material properties, and the associated ultimate 
failure loads, these assessments are very difficult 


V. Generic Lessons Learned 

While there are lessons learned that emerged from specific events as detailed in Sections III and IV, there are 
also lessons learned that have developed over the course of time that emerged from repeated instances of challenges. 
Those lessons learned are detailed below. 

A. Evolution of Structural Inspection Plan 

The Space Shuttle Orbiter structural inspection program was developed by the Pan American Airways (Pan AM) 
shuttle maintenance analysis team in the mid 1980’s. The inspections included surveillance, detailed and special 
detailed non-destructive evaluation (NDE) inspection levels based primarily on the philosophy that three inspection 
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intervals should be implemented over the certified 100 mission life. Ultimately these inspection intervals were 
reduced to account for unknowns and adjusted to align with program defined Orbiter Major Maintenance periods 
(OMM). Although the program was based on a commercial aircraft philosophy; the new Space Shuttle Orbiter had 
limited flight experience and life analysis data to support the inspection requirements developed and the associated 
inspection intervals. Thus the initial Orbiter structural inspection program relied heavy on analysis data. Space 
Shuttle induced environments were not fully defined, and there were no full scale static fatigue test performed on the 
Orbiter, only static load deflection testing and some component level fatigue testing. These factors all contributed to 
the implementation of a very conservative structural inspection program for the Orbiter at the outset. Rightly, the 
Pan AM team recognized this early on and recommended a review of the inspection program as flight data and 
experience was accumulated. 
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Figure 5-1. Orbiter Structure Primary Components 

As the operational phase of the program continued the conservative nature of the structural inspections resulted 
in an extremely intrusive and expensive maintenance program. Additionally, access requirements to perform these 
inspections resulted in an undesired level of collateral damage. Many of these inspections required large component 
removals that did not fit in a standard processing flow timeline and subsequently many inspection waivers were 
requested. During reviews of these waivers, engineering found it very difficult to justify performance based on the 
lack of good technical rational documented during the initial inspection program development. So many of these 
waivers were approved and inspections were deferred to a later date. This became a serious concern for engineering 
as time progressed and a culture was being developed that structural inspection are “requested” and not mandatory. 

It wasn’t until a significant amount of flight data was accumulated combined with the implementation of a 
Fracture & Durability (Life) Analysis effort that the required insight became available to properly specify the 
appropriate inspections, type and intervals for the Orbiter. It was at this time that the program authorized a complete 
and rigorous reset of the structural inspection program based on a Reliability Center Maintenance (RCM) Approach. 
The new process was incorporated and included new inspection requirements based on margin of safety, life 
analysis, previous inspection data, problem reports, and technical community knowledge. 

The new sets of structural inspection requirements were greatly improved. Engineering now had a set of 
inspection requirements that were tied to specific justifiable technical parameters. These parameters included 
corrosion / time, margin, fracture / life, and part history driven requirements. New intervals were established at this 
time and a majority of the inspections fell to longer intervals consistent with the conservative nature of the initial 
program. However a subset of new directed shorter intervals did fall out for critical structure identified during the 
review. The obvious success of the new program was that inspections were implemented for the right parts at the 
right intervals and using the right inspection level (surveillance, detailed or special detailed (NDE)) and this resulted 
in a significantly less impact to the processing flows. After the implementation of the new requirements a much 
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smaller number of waivers were requested and those that were had sufficient technical supporting rationale 
associated with the approval or disapproval decision to reduce program risk. 

Lessons Learned: 

1. Early implementation of a structural inspection program based on all of the components of a good RCM 

approach supported by sufficient technical rationale. 

2. Use fatigue testing if possible. 

3. Use fleet leader concept if possible. This means having a dedicated subsystem that is built before or at the 
same time as the oldest subsystem currently in service. As long as that dedicated subsystem is exposed to 
the same conditions as the oldest system in service, key data can be revealed from it and applied to the rest 
of the fleet. 

B. Designing for Operations (Cognizance of High-Traffic Areas, etc) 

Due to the length of time that the Space Shuttle Orbiter was operational it became very obvious that certain areas 
of the vehicle were more susceptible to ground processing damage. These areas were generally where a 
combination of sensitive structural hardware was exposed to a high personnel traffic count. Access is required for 
maintenance, modification or inspections and quality inspectors, technicians, and engineers all access through main 
ingress / egress points in the Space Shuttle fuselage. In addition to ingress / egress requirements avionics bays or 
equipment lockers also receive a significant amount personnel interaction to inspect or remove and replace 
components such as black boxes. There is some trade space here but despite the usage of ground support equipment 
(GSE) platforms and/or protective covers that are utilized for operational effectiveness, structural components in 
these areas must be robust to account for the personnel traffic. Personnel are likely to be carrying tools, lighting 
equipment, GSE and other objects that can cause damage to sensitive flight hardware. 

For example the Space Shuttle Orbiter utilizes a very thin walled struts in the truss like ring frames of the mid- 
fuselage. There is one main ingress / egress access point to the mid-fuselage and then a platform system is used 
down the centerline to facilitate traffic through the length of the fuselage. A large number of these highly sensitive 
primary structure boron aluminum struts that are close to these traffic paths incurred damage that resulted in 
expensive replacement parts. As the program matured and protective covers were refined (soft covers to hard 
covers), less damage occurred. However, the problem was best corrected when the damaged boron aluminum tubes 
were replaced with new thicker walled aluminum tubes that did not share the same high sensitivity traits. The weight 
penalty trade was acceptable in this case and the cost was lower for the new replacement struts. If this type of more 
robust configuration had been utilized in the high traffic areas many of the strut replacement issue and high 



Figure 5-2. Main Ingress/ Egress into the Space Shuttle Mid-Fuselage Compartment. 

Highly sensitive thin Boron/ Aluminum Struts line ingress/ egress route. 

associated costs would not have occurred. 

Access to the internal sections of the Orbiter wings is another example where a more robust structure would have 
been beneficial. Similar to the mid-fuselage there is one main ingress/ egress point and one main traffic path that is 
lined with thin walled sensitive aluminum struts. In addition, the traffic path in the internal wing has sections of 
honeycomb panels that are crawled over that have very thin face sheets and are also sensitive to high personnel 
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traffic. Both the thin walled aluminum wing struts and the honeycomb panels received significant repair activity 
over the life of the program. The Space Shuttle also used lightweight thin face sheet aluminum honeycomb panels to 
house the avionics compartments/ bays. The avionics boxes were frequently removed for testing and evaluation and 
also saw a high percentage of personnel traffic. Despite the use of GSE to support the weight of the boxes and 
protective covers, these compartments still received a large number of damages. Even though these structural 
components were not part of the primary load path, damage to this type of sensitive hardware needs to be repaired so 
that propagation of an initial defect cannot lead to a more serious damage event. This problem was significantly 
mitigated on the Space Shuttle program by installing thick aluminum doublers over the thin honeycomb panel face 
sheets to provide a more robust surface that was less susceptible to damage. 



Figure 5-3. Main Ingress/ Egress into the Space Shuttle Wing Compartment. 

Lower surface is thin aluminum honeycomb face sheet with thin walled struts in close proximity. 



Figure 5-4. Typical Avionics Bay Honeycomb Panel Damages. 

Thin face sheet was easily damaged by high traffic and required repairs. 

As noted previously there is a tradeoff between the weight penalty implied by the use of more robust structure 
targeted in predicted high traffic areas and the usage of ground support equipment platforms and protective covers to 
mitigate damage. These robust structures should provide high strength to weight ratios along with good damage 
tolerance in high traffic areas. For Space Shuttle Orbiter the weight penalty to increase robustness in several areas, 
using low cost solutions, turned out to be acceptable during its operational phase and subsequent modifications were 
incorporated. A combination of these options will likely provide the best solution but designing in robustness in 
targeted high traffic areas, when possible, is clearly beneficial from an operational standpoint. 
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Lessons Learned: 

1. Target well known or predicted high personnel traffic areas for less sensitive more robust structures. 

2. Use ground support equipment to protect sensitive structures in high traffic areas 


VI. Conclusion 

Through the life of the Space Shuttle Program, the Orbiter structures and mechanisms performed remarkably 
well. This is in no doubt due to the highest level of rigor that went into the design, analysis, test and assembly of the 
vehicles. Through 30 years of flight experience however, operations changed, environments changed, and in some 
cases, the system simply did not perform as expected. It is through these experiences that future projects should 
apply the lessons presented herein as we continuously improve toward ever more reliable space systems. 
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